Cloudanix VulnDB

CVE-2026-93123

None

CVSS

—

EPSS

0.2%

Published

Sep 17, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A timing bug in Linux handling of certain Qualcomm serial chips can cause newly sent data to be lost when the system tries to clear the send buffer at the same time an earlier transfer finishes.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Data Tampering
Component
OS kernel
Class
Race Condition
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Race condition in qcom-geni serial DMA TX completion allows stale tx_remaining value from a prior DMA transfer to advance and discard newly written bytes in the transmit FIFO after uart_flush_buffer() has reset the FIFO but before the old completion interrupt is processed.

Why it matters to the business

Serial device communication on affected Linux systems may experience silent data loss or corruption during flush/write sequences, potentially disrupting connected hardware operations and requiring restarts or manual intervention.

How an attack unfolds

An attacker with local access triggers a DMA transfer, forces a uart_flush_buffer via userspace or driver interaction, then rapidly writes new data before the stale DMA completion handler runs, causing the handler to discard the fresh payload instead of advancing only the original bytes.

How to fix it

Apply the upstream kernel patch that marks in-flight DMA transfers as stale upon FIFO flush so that stale completions no longer advance the transmit FIFO; rebuild and deploy the fixed kernel image to all affected systems.

How to confirm the fix worked

Confirm the presence of the code change that sets a stale flag on flush and skips FIFO advancement for marked transfers; exercise serial flush/write sequences under load and verify that new data is not discarded.

Typical attack path

  1. Obtain local execution context on the target system
  2. Initiate a DMA-backed serial transmit operation via the qcom-geni driver
  3. Trigger uart_flush_buffer while the DMA transfer has completed in hardware but the interrupt is still pending
  4. Immediately write new data to the serial port before the stale completion is handled
  5. Observe the new data being incorrectly discarded by the stale tx_remaining advancement

How to detect it

Examine kernel logs for serial qcom-geni DMA completion messages around the time of observed data loss; correlate with userspace processes performing rapid flush and write operations on affected serial ports; no public exploit artifacts are known.

What your security team should do

  • Prioritize patching systems that rely on qcom-geni serial hardware for critical device communication
  • Monitor kernel update channels for the merged fix and schedule testing in lab environments that reproduce serial workloads
  • Review any custom serial drivers or userspace code that performs frequent flushes for similar timing assumptions

The record

In the Linux kernel, the following vulnerability has been resolved: serial: qcom-geni: do not advance stale DMA completions The qcom GENI serial DMA TX completion path advances the transmit fifo by the number of bytes recorded in port->tx_remaining. If uart_flush_buffer() runs after the hardware has completed a DMA transfer but before the DMA completion interrupt has been handled, the serial core resets the transmit fifo while port->tx_remaining still describes the old DMA transfer. A previous fix avoided advancing an empty fifo by checking that the fifo length is at least tx_remaining. That still does not distinguish the old DMA payload from new bytes written after the flush. If userspace writes new data before the stale DMA completion interrupt is handled, the fifo can again contain at least tx_remaining bytes and the stale completion can advance and discard those new bytes. Mark an in-flight DMA transfer stale when the transmit fifo is flushed. The later completion still unprepares the original DMA mapping using the saved length, but it no longer advances the transmit fifo.

Affected packages

Ecosystem Package Introduced Fixed